A data controller is a person or company (excluding a person acting in his capacity as a staff member) who alone or jointly with others determines the purposes and means of processing personal data.